NSE 7 - SD-WAN (NSE7_SDW) (NSE7_SDW) — Questions 151–216

For an SD-WAN rule to use an overlay interface, that interface must be a member of the SD-WAN zone. If the interface was added to the template but not properly mapped or included in the zone on the FortiGate, the rule will not match or forward traffic correctly. This is a common configuration oversight.

The http-match parameter specifies the exact string the FortiGate searches for in the HTTP or HTTPS response body; a match confirms the path is healthy. This satisfies the stem's requirement for validating internet reachability via response content.

The kernel performs a route lookup on the first packet, sees the destination reachable via a BGP-learned dynamic route pointing at the IPsec overlay, and triggers an IKE shortcut negotiation to the target spoke's tunnel IP, establishing the direct spoke-to-spoke path.

Performance SLA is the correct element for defining health checks that monitor link quality. It supports various protocols including HTTP, and allows you to specify a URL as the target. The SLA sends probes and measures latency, jitter, and packet loss, providing the data needed for SD-WAN routing decisions. This directly fulfills the requirement of monitoring an internet link with HTTP requests.

In IPsec Phase 1 configuration, the 'interface' parameter specifies the outgoing physical interface that the tunnel will use. Setting this ensures the tunnel is established only when that interface is up and binds the tunnel to it. This is essential for SD-WAN because it allows the tunnel to be associated with a specific member, enabling proper health checks and steering.

Phase 2 proposals must match on both peers for the IPsec SA to establish. If the encryption or authentication algorithms differ, the tunnel will fail to negotiate. In SD-WAN overlays, ensuring consistent Phase 2 proposals across all members prevents intermittent tunnel failures. This is a fundamental IPsec requirement and applies regardless of SD-WAN configuration.

The probe protocol determines how the SLA measures link health — ICMP ping, TCP, HTTP, or UDP echo — so it must be selected before the SLA can generate meaningful latency and jitter metrics. Without it, the Performance SLA cannot evaluate member link quality.

The 'lowest latency' strategy in an SD-WAN rule selects the member with the lowest measured latency among those that satisfy the SLA. By referencing the latency SLA, the rule ensures that only members meeting the SLA are considered, and among them, the one with the lowest latency is chosen. This directly fulfills the requirement.

FortiManager maintains a revision history for each managed device. When the Install Wizard successfully installs an SD-WAN template, it records the change as a new revision. This enables administrators to view previous configurations and roll back to an earlier revision if issues arise, which is essential for maintaining stability in large deployments.

This command reports each SD-WAN member's SLA health-check status, including latency, jitter and packet loss against configured thresholds. It directly satisfies the stem's requirement to verify member status and SLA health from the CLI, rather than inspecting interface state or routing tables.

FortiManager provides an SD-WAN template that allows you to define SD-WAN settings centrally and assign them to managed FortiGates. This template simplifies consistent configuration and deployment across multiple devices. It is the correct tool for centralized SD-WAN management and ensures that changes are propagated uniformly.

The SD-WAN template in FortiManager includes a 'Performance SLA' section where health check servers are defined. By configuring the server IP address here, the administrator ensures that all devices using this template will have the same health check server, achieving consistency across the managed FortiGates.

Dynamic mapping in FortiManager allows administrators to assign templates or template variables based on device attributes such as tags. By using dynamic mapping, the SD-WAN rule can be conditionally applied only to devices that match the specified tag. This provides granular control over which devices receive which configuration.

Flow-based inspection, where supported, permits NP6/NP7 hardware offloading of session traffic, moving packet processing off the CPU. This preserves Antivirus, Web Filtering and IPS enforcement while reducing the inspection overhead causing the SD-WAN performance issues.

SD-WAN rules with SLA targets can trigger session re-evaluation when a member's SLA fails. If the rule allows re-evaluation, FortiOS may move existing flows to another member; stateful security profiles like IPS and Application Control cannot always preserve state across members, so sessions can be reset. Disabling re-evaluation or using session-pickup-aware settings mitigates this.

SD-WAN rules only steer traffic; they cannot apply security profiles. The profile must sit in the firewall policy that matches the steered traffic, because that policy performs the UTM inspection after the SD-WAN rule selects the egress member.

FortiManager pushes configuration to managed FortiGates and reports the outcome per device; the Device Manager installation status column shows whether the change was installed successfully or failed. This directly confirms the policy package was applied, satisfying the need to verify the SD-WAN change took effect.

The Performance SLA in an SD-WAN template defines the thresholds for latency, jitter, and packet loss that determine link quality. When a link's health check results exceed these thresholds, the link is considered out of SLA, and SD-WAN rules can then route traffic to an alternate link. This is exactly what the engineer needs to trigger failover based on performance degradation. The SLA is referenced by SD-WAN rules to make routing decisions.

Member priority and weight determine which tunnel the SD-WAN rule selects among qualified members; a misconfigured weight can rank broadband above MPLS. Checking these satisfies the discrepancy by confirming the rule's own selection logic, not just tunnel health.

Using the 'SLA' strategy allows the SD-WAN rule to evaluate the health check's latency and jitter measurements against configured thresholds. If the MPLS link meets the SLA, VoIP traffic is routed over it. If not, the rule can fail over to another link if configured. This ensures that VoIP traffic only uses the MPLS link when it meets quality requirements.

The 'Best Quality' strategy selects the member with the best measured quality (lowest latency and jitter) among those that meet the SLA. This directly aligns with the requirement to use the best path based on latency and jitter. It also provides failover: if the best member fails the SLA, the next best is chosen. This strategy is designed for exactly this use case.

Enabling preserve-session-route under the IPsec phase1-interface ensures that when a session is established over a specific IPsec tunnel, return traffic is forced back through that same tunnel, even if multiple tunnels share the same remote gateway IP. This setting maintains session stickiness at the tunnel level, preventing asymmetric routing. It is the correct solution because it directly addresses the requirement to keep return traffic on the originating overlay, which is critical when remote gateways are identical.

Security profiles are enforced in the firewall policy that matches the session, and the SD-WAN rule only selects the egress member after policy lookup. Applying the IPS sensor in that policy ensures inspection occurs before the selected tunnel carries the packet. The SD-WAN zone is referenced as the outgoing interface, so all members inherit the same inspection.

In FortiOS, an interface must have its role set to 'WAN' to be eligible for inclusion in an SD-WAN zone. The role is configured under the interface settings. Without this role assignment, the interface will not be listed as an available member when configuring SD-WAN zones.

An SD-WAN Health Check object defines the probe type, target, interval and failure thresholds used to judge link quality. It must exist in the template before a service rule can reference it, since the rule binds to that object's SLA criteria.

SD-WAN template changes are propagated to managed FortiGates through a policy package installation. Once the template is modified and saved in FortiManager, the administrator must install the associated policy package to the device for the changes to take effect. This is the standard workflow for deploying template modifications in FortiManager.

The 'SLA' strategy instructs the SD-WAN rule to choose members that meet the SLA targets. You must also specify which SLA targets to use. This combination allows the rule to select the best link and fail over when the primary link violates the SLA. Other strategies do not provide SLA-based selection.

Zone-based abstraction groups interfaces by role, so WAN links are managed as logical zones rather than per-interface rules. This reduces configuration duplication and simplifies policy changes across many branches, directly delivering the simplified WAN management benefit the question asks for.

FortiOS evaluates SD-WAN rules in ascending priority order. The rule with Priority 1 is checked first. If its associated SLA health check fails, that rule is skipped and the next rule (Priority 10) is evaluated, allowing fallback to a secondary path. This matches the intended design of priority-based rule ordering.

SD-WAN is a feature that must be enabled in the FortiGate GUI via System > Feature Visibility before SD-WAN configuration options become available. Once enabled, the administrator can create SD-WAN zones and add interfaces. Without this step, the SD-WAN menu and related settings are hidden, preventing any SD-WAN zone creation. This is a mandatory first step in a new deployment.

In FortiManager, SD-WAN templates are created and managed under Policy & Objects > SD-WAN Templates. This centralized location allows administrators to define reusable templates that include SD-WAN interfaces, health checks, and rules. From here, templates can be assigned to policy packages for deployment to managed FortiGates.

Best Quality selects the member that meets all SLA thresholds and has the best quality metric. WAN1 meets all thresholds, but WAN2 exceeds the jitter threshold (25 ms > 20 ms). Since WAN2 fails the SLA, it is not considered, leaving WAN1 as the only eligible member, so it is selected.

CLI scripts execute arbitrary FortiOS commands on managed devices via FortiManager, letting administrators modify SD-WAN policy objects and rules across all devices in one push. This satisfies the requirement to update policies fleet-wide without manually editing each device.

Even if the Phase 2 selectors are correct, the FortiGate must have a route to the health check server pointing to the tunnel interface. If the route is missing or incorrect, the probe packets will not be sent through the tunnel, and health checks will fail. This is a common oversight in SD-WAN deployments, especially when using dynamic routing or multiple paths.

The Install Wizard in FortiManager allows you to select multiple managed FortiGates and install configuration changes, including updated SD-WAN templates. After modifying the health check, the administrator can run the Install Wizard, select all affected devices, and push the changes in one operation, ensuring consistency and saving time.

SD-WAN zones are used to group member interfaces in an SD-WAN configuration. They simplify policy and routing by allowing rules to reference the zone instead of individual interfaces. In FortiManager, when creating an SD-WAN template, the administrator defines zones and assigns interfaces to them, which is the correct way to group members.

An SD-WAN Zone groups interfaces and overlay members sharing identical routing and policy treatment, letting administrators apply one rule set across them. This satisfies central management's need to route traffic by logical segment rather than per-link, so FortiGate policies reference the zone and members inherit consistent steering without duplicated configuration.

Enabling Interface Preference makes the rule select the outgoing interface directly, bypassing the SLA strategy's link-quality evaluation entirely. This satisfies the scenario's requirement to force traffic onto a specific member, since SLA-driven selection would otherwise choose the best-performing link and ignore the configured preference.

The Performance SLA's packet loss threshold defines the percentage of lost probes above which the interface is marked unhealthy and removed from the SD-WAN routing table. Latency and jitter thresholds affect path preference, but packet loss is the reachability health determinant.

SD-WAN member interfaces must exist before they can be referenced within a template. The template binds these individual interfaces into the SD-WAN zone and defines their participation, so the member interfaces are the prerequisite object that must be defined first.

SD-WAN templates permit physical ports, VLAN interfaces and VPN tunnels as members, letting overlays and underlays share the same SD-WAN fabric. Loopback and management-only interfaces are excluded, so this option matches the supported membership set.

Under the Priority strategy, members are ranked by priority value, and the highest-priority member is preferred while its SLA is met. When that member breaches its SLA, FortiGate immediately redirects traffic to the next-highest-priority member, satisfying the rule's requirement for deterministic ordered failover rather than load balancing.

The hold-down timer specifies how long the Performance SLA waits before marking a member or route as up again after it recovers. Extending it delays the return to the up state, suppressing rapid up/down transitions that cause route flapping.

Central management pushes one SD-WAN template to many FortiGates, so inheritance propagates configuration and policy changes consistently. This removes per-device drift and manual repetition, which is the scalability constraint the stem contrasts against local configuration.

Weight is FortiOS-proprietary and evaluated before local preference in the BGP best-path algorithm, so tagging MPLS-learned routes with a higher weight forces their selection locally. This satisfies the stem's constraint: influencing path choice on this FortiGate without altering AS-path or other attributes propagated to peers.

Dynamic interface mapping allows the use of metadata variables for interface names, enabling a single template to be applied to devices with different interface naming conventions. This is the correct feature for reusability across heterogeneous devices, as it resolves the variables based on each device's metadata during installation.

FortiManager allows per-device overrides or metadata variables that can replace template values. If a device has a specific health check server defined via metadata or a local override, it will use that instead of the template's value. This is the most likely cause for the discrepancy, as it explains why the expected server is not used despite the template being correct.

SD-WAN rules define how traffic is steered based on criteria such as source, destination, and application. They also specify the action when a health check fails, such as selecting an alternate member or using a specific strategy. The rule references the Performance SLA to determine link health and then applies the configured action to redirect traffic.

In FortiManager, SD-WAN health checks are used to define performance SLA probes. You can specify the protocol (HTTP, ICMP, DNS, etc.), target, and other parameters. This is the correct object to configure HTTP probe settings for monitoring WAN link quality within an SD-WAN template.

The lowest-cost (SLA) strategy selects the member with the lowest cost among those that meet their SLA. wan1 has the lowest cost (10) and meets SLA, so it is selected. wan2 also meets SLA but has a higher cost, so it is not chosen. wan3 fails SLA and is not considered. Thus, wan1 is the correct choice.

The lowest-latency strategy selects the member with the best measured latency from the associated performance SLA. When the SLA threshold is breached, the member is considered out of SLA and the rule steers traffic to the next-best member that meets the SLA. This directly satisfies the requirement for automatic failover based on latency.

Latency, jitter and packet loss are precisely the metrics FortiManager's SD-WAN Monitor reports under Health Check status, satisfying the stem's requirement for performance data per monitored SLA target. These three values drive FortiGate's SLA calculations, so displaying them confirms whether each health-check probe currently meets its configured thresholds.

With a 5-second probe interval and a failure threshold of 3, it takes up to 15 seconds (plus processing) for the SLA to be marked as failed after the first breach. During this window, the member is still considered in SLA, so the SD-WAN rule may continue to use it. This delay explains the intermittent sending of traffic over a link that no longer meets the thresholds. Adjusting these values can make failover more responsive.

When an SD-WAN template is assigned to a managed FortiGate and the policy package is installed, the template's configuration replaces the device's local SD-WAN settings. FortiManager provisions the device with the template content, so any pre-existing local SD-WAN configuration is discarded. This ensures consistency but requires that the template be complete before installation.

The Performance SLA includes thresholds for latency, jitter, and packet loss. To consider the link healthy only when round-trip time is below 100 ms and packet loss below 2%, you must set the latency threshold to 100 ms and the packet loss threshold to 2%. These thresholds are evaluated against the probe results to determine SLA status.

A Performance SLA with quality thresholds is what allows the FortiGate to declare a member degraded based on measured latency, jitter, and packet loss rather than waiting for the physical link to go down. Without it, the SD-WAN rule engine has no quality signal, so proactive detection of degradation before users notice is impossible in this deployment.

An application-based SD-WAN rule allows the administrator to select specific application signatures, such as Microsoft Teams, from the application database. This ensures that traffic is matched based on deep packet inspection of the application, which is accurate and dynamic. The rule can then be prioritized by placing it above other rules or by setting a higher priority. This is the correct method to steer Microsoft Teams traffic specifically.

The Lowest Cost (SLA) strategy selects the member with the lowest configured cost among those that meet the SLA. It does not distribute traffic across multiple members; it is a primary/backup approach. Since member1 has a lower cost and is healthy, all traffic uses member1. Member2 would only be used if member1 failed its SLA or if its cost were lower.

FortiManager validates the template against the target device's interface list before pushing. A referenced interface absent on that FortiGate causes the install to abort with a configuration error, rather than silently skipping the reference or applying a partial config.

Installing the configuration pushes the prepared SD-WAN policy and settings from FortiManager down to the managed FortiGate devices. Without this install step, the centralised configuration never reaches the devices, so the SD-WAN deployment cannot take effect on the network.

In FortiManager, the SD-WAN Performance SLA object defines health check parameters, including the protocol (such as HTTP), server address, interval, and thresholds. This object must be created first, then referenced in the SD-WAN template. It is the correct object type for defining an HTTP health check that can be reused across multiple templates.

An SD-WAN zone is a logical grouping of one or more SD-WAN members (interfaces). It simplifies configuration by allowing you to reference the zone in SD-WAN rules instead of individual interfaces. You must create a zone and add the member interfaces to it. This is the standard method to group WAN links for SD-WAN rule selection in FortiOS.

The SD-WAN health check object defines the monitoring parameters, such as protocol (ICMP), server address, interval, and thresholds. It is a reusable object that can be referenced when configuring SD-WAN members or rules. Creating it first allows the engineer to then reference it in the template, ensuring proper health monitoring.

Lowest Latency (SLA) selects the member with the lowest measured latency among those that meet the SLA. This directly matches the requirement to prefer the member with the lowest latency for the SaaS application. It uses the performance SLA metrics to make the decision.

If the performance SLA health check is not properly configured or is failing, the SD-WAN rule cannot determine the best path based on SLA criteria. This would result in the rule not being enforced as expected. The health check must be active and passing for the SLA to be evaluated.

The Configuration Diff feature in FortiManager compares the device's current running configuration against the configuration that FortiManager expects based on the assigned template. This allows the administrator to identify any drift, such as manual local changes on the FortiGate, and confirm that the SD-WAN template settings are correctly synchronized across all managed devices.